NVD published two AhsayCBS vulnerabilities on 4 October. Huntress saw the first exploitation at 23:20:15 UTC on 7 October.

Three days. No patch existed then and, at the time of Huntress's write-up, none existed at all.

The chain

CVE-2026-105133 is the way in: a medium-severity authentication bypass in the checkSysPwd function, which lets a random token stand in for valid credentials.

CVE-2026-105134 is what the bypass buys: a critical unauthenticated remote code execution flaw in the Replication Receiver component, reached through one API endpoint, running as NT AUTHORITY/SYSTEM.

A note on those labels, because two write-ups have them the other way round. The medium one is the bypass; the critical one is the execution. Huntress assigns them that way and it is the firm that watched the attack.

Five organisations had been targeted as of 8 October.

The version that was supposed to be fine

Earlier reporting indicated that 10.3.4 was not susceptible. Huntress's 8 October update says plainly that it is.

That is the most urgent sentence in this story. An administrator who read the first round of coverage, checked their version, saw 10.3.4 and moved on has done the work and is still exposed. There is no fixed release to move to — every version up to and including 10.3.4 is affected, and the mitigation is network control, not patching.

What they install

The post-exploitation is almost a catalogue of current technique.

The payload is staged by curl from an Alibaba Cloud object-storage host. Four files: a PowerShell script, and three that matter — edge.exe, msedge.exe and a config.

edge.exe is XMRig, the Monero miner, renamed to look like a browser. It points at Kryptex — the same mining service behind the botnet that resolves its command server out of a poem on GitHub. Two unrelated campaigns in a fortnight cashing out through the same place.

msedge.exe is a modified copy of NSSM, a legitimate service manager, used to keep the miner running and restart it after crashes or reboots. The service it creates is called MicrosoftEdgeUpdateSvc, which is one character of plausibility away from the real thing, and it runs as SYSTEM.

In some incidents the attacker instead configured a malicious replication receiver and dropped a JSP webshell into the directory the application already serves.

Then there is WinRing0x64.sys, downloaded with certutil. It is a real, signed, vulnerable kernel driver. The usual reason to bring one is to disable endpoint security; Huntress reads this case differently, as giving the miner kernel-level hardware access. Bring-your-own-vulnerable-driver for performance rather than evasion is an unusual thing to see.

The script that watches for you

The best detail is the PowerShell script, which Huntress describes as AI-assisted.

It stops the mining service when Task Manager opens. It restarts it when Task Manager closes. It kills Task Manager at 18:00, or after an hour if it has been left open overnight — on local time.

That is not evasion aimed at security software. It is evasion aimed at a person: the administrator who notices a slow machine, opens Task Manager, sees nothing unusual, and closes it. Whoever wrote it understood that the detection mechanism most likely to catch a cryptominer is somebody wondering why the fans are loud.

Backups are the target, which makes the advice awkward

AhsayCBS is used primarily by managed service providers and system integrators to centralise backup for their customers. One compromise is one provider and, potentially, the backups of everyone behind it.

Which leads to the uncomfortable part of Huntress's remediation. Its advice, correctly, is that any host matching the indicators should be fully re-imaged from a trusted backup, because secondary backdoors may be hidden.

Set that advice against what the compromised product is. The guidance is sound; it just lands differently when the system you are rebuilding is the one that holds the restore points. A backup platform is a high-value target precisely because owning it means owning both the live data and the way back from losing it, and any recovery plan that routes through it has to assume it might be the thing that is wrong.

What to do

  • Get the management interface off the internet. Trusted IPs or VPN only. There is nothing to patch.
  • Check your version and ignore the earlier guidance about 10.3.4.
  • Look for child processes spawned by the CBS service executable, for edge.exe or msedge.exe running from Temp, for a MicrosoftEdgeUpdateSvc service, and for WinRing0x64.sys.
  • Preserve evidence before changing anything. Record processes, services, connections and logs first; re-image second.
  • Huntress published four Sigma rules for this campaign.

What is not established

  • When a patch will ship. The vendor's plans were not confirmed at the time of the reporting.
  • How many organisations are affected. Five is what one vendor's customer base showed on 8 October.
  • Whether the MSPs targeted had their customers' backups reached, as opposed to the platform itself.
  • Who is behind it. The toolset is commodity and the payout is a public mining pool.
  • Whether the same actor is behind both the webshell incidents and the mining incidents, which Huntress describes as different patterns.